---

What it does

ANANSI CLI is a terminal-first attack surface recon tool for pentesters and bug bounty hunters. Give it a domain — it runs a full ten-phase intelligence and exploitation pipeline and prints raw technical output you can act on immediately.

By default, ANANSI filters out the noise and only displays found assets (e.g., live subdomains, active HTTP/HTTPS hosts, successful TLS certificates, missing security headers on live URLs, exposed paths, and confirmed takeovers). This keeps your terminal clean. If you want to see all attempted checks, including dead subdomains, failed connections, and unchecked endpoints, simply enable the verbose flag (-v/--verbose).

Phase	Module	What it finds
01	DISCOVERY	Subdomains via crt.sh CT logs + DNS brute-force wordlist
02	PROBE	Live HTTP/HTTPS hosts — status codes, servers, redirect chains, titles
03	TLS	Certificate expiry, SANs, protocol version, cipher, self-signed detection
04	HEADERS	Missing security headers, CORS misconfigurations
05	PATHS	Exposed files — .env, .git, configs, admin panels, backups, API docs
06	TECH-STACK	Deep audit of detected platforms — version detection, WordPress plugins/themes, XML-RPC, user enumeration, config backups, known-vulnerable version matching
07	TAKEOVER	Dangling CNAMEs pointing to unclaimed cloud services
08	OSINT	Emails, phone numbers, employees, WHOIS registrant data
09	CHAIN	Assembles findings into multi-step exploit paths (low → high → critical) with per-step exploitation techniques
10	EXPLOIT	Actively proves exploitable findings against the authorized target with live HTTP request/response evidence

---

Performance & Architecture

• Native Go DNS Resolver: Bypasses slow cgo-blocked system lookups using pure Go goroutines.
• Shared Connection Pool: A single process-wide HTTP transport with keep-alives is reused across every phase and every module, so TCP + TLS handshakes happen once per host instead of once per request.
• TTL DNS Cache: Resolved subdomains are cached for 60s, so recursive/mutation/TLS-SAN phases never re-query the resolver for the same name.
• Fixed Worker Pools: Paths, discovery, probe, and techstack all run on fixed worker pools (one goroutine per --threads, jobs pulled from a channel). No goroutine-per-job churn — even an 8,000+ rule path sweep stays at stable concurrency.
• Concurrent Probing: HTTP Probes, TLS analyses, and Security Header checks are fully parallelized.
• Smart Takeover Filtering: Targets only subdomains with verified dead CNAME records.
• Parallel Exposed Path Probing: Custom 404 baselines fetched concurrently; the deep-audit module adds a soft-404 baseline so catch-all servers don't produce false positives.
• Version reuse: the tech-stack module reads CMS versions from generator meta tags and static-asset query strings already present in the homepage body, and discovers WordPress plugins from the same body — minimising extra requests.
• robots.txt mining: every live host's robots.txt Allow/Disallow entries are turned into extra path probes, surfacing intentionally-hidden directories for one extra request per host.

Tech-Stack Deep Audit

When a host is fingerprinted as WordPress, Drupal, Joomla, Magento, Ghost, Moodle, MediaWiki, Laravel, or another platform, ANANSI descends that stack instead of stopping at the surface: